Performance and flow analysis method for communication networks

ABSTRACT

A system and method are used for visually representing performance and flow analysis of a communication network having devices connected by links. The system includes a first memory for storing a graphical representation of the communication network and showing the devices connected by links and a second memory storing data representing performance and flows in the communication network. A processing system is operatively connected to the first and the second memory and to a display. The processing system selectively maps the data on the graphical representation of the communication network by varying visual characteristics of the devices and the links for viewing on the display.

CROSS-REFERENCE TO RELATED APPLICATION

[0001] This application claims priority of Application No. 60/275,613,filed Mar. 14, 2001.

BACKGROUND OF THE INVENTION

[0002] Communication networks are increasingly becoming criticalresources. In-depth understanding of the communication networks'behavior and what the physical and application flows that are crossingnetwork devices is imperative in order for the communication networks toprovide good quality of service to network service customers.

[0003] A communication network may consist, in part, of an enterprisenetwork. An enterprise network typically includes geographicallydispersed devices under the control of a particular organization. It mayconsist of different types of networks operating together as well asdifferent computer systems. As such enterprise networks are gettinglarger and more complex, analyzing the performance or flows of thesenetworks is a challenging task. This is due, in part, to the substantialamount of data an operator must review for such an analysis.

[0004] The present invention is directed to improvements in andanalyzing performance and flow for communication networks.

SUMMARY OF THE INVENTION

[0005] The present invention relates to a method and system of analyzingcollected performance and flow information for networks.

[0006] In accordance with one aspect of the invention there is discloseda system and method for visually representing performance and flowanalysis of a communication network having devices connected by links.The system includes a first memory for storing a graphicalrepresentation of the communication network and showing the devicesconnected by links and a second memory storing data representingperformance and flows in the communication network. A processing systemis operatively connected to the first and the second memory and to adisplay. The processing system selectively maps the data on thegraphical representation of the communication network by varying visualcharacteristics of the devices and the links for viewing on the display.

[0007] In accordance with another aspect of the invention a system andmethod is provided for mapping performance and flow analysis of acommunication network having devices connected by links. The systemincludes a first memory for storing a graphical representation of thecommunication network and showing the devices connected by links. Asecond memory stores data representing performance and flows in thecommunication network. A third memory stores a plurality of symbolsrepresenting different devices and a plurality of edges representinglinks. Processing means selectively map the data on the graphicalrepresentation of the communication network by varying visualcharacteristics of the symbols and the edges responsive to theperformance and flows in the communication network to build a graphicaldisplay

[0008] Further aspects and advantages of the invention will be readilyapparent from the specification and from the drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0009]FIG. 1 is a block diagram of a system for performing performanceand flow analysis for a network;

[0010]FIG. 2 is a graphical representation of how network elements aredefined in a network topology;

[0011]FIG. 3 is a graphical representation of how the network elementsof FIG. 2 are illustrated in a display system in accordance with theinvention;

[0012]FIG. 4 is a graphical representation of a network topology;

[0013]FIG. 5 illustrates a display generated in accordance with theinvention for illustrating performance and flow for the topology of FIG.4;

[0014] FIGS. 6-9 illustrate mapping techniques for representing metricsfor different types of information in accordance with the invention;

[0015]FIG. 10 is a graphical representation, similar to FIG. 3,representing bidirectional flows between two devices;

[0016]FIG. 11 is an exemplary display of bidirectional flows between twodevices;

[0017]FIG. 12 is a graphical representation of a network topology for aview usage case in accordance with the invention;

[0018]FIG. 13 is an illustration of a display for the topology of FIG.12 for illustrating a flow/volume view usage case;

[0019]FIG. 14 is an illustration of a display for the topology of FIG.12 for illustrating a flow/congestion view usage case;

[0020]FIG. 15 is a generalized representation of a database for storingtopology and statistical information used in the method and system ofthe present invention;

[0021]FIG. 16 is a flow diagram illustrating collection and storage ofdata for building the database of FIG. 15;

[0022]FIG. 17 is a flow diagram illustrating a visualization programalgorithm in accordance with the invention;

[0023]FIG. 18 is a graphical representation of a portion of the topologyfor illustrating operation of the visualization program of FIG. 17; and

[0024]FIG. 19 is a display generated by the visualization program ofFIG. 17 using the topology of FIG. 18.

DETAILED DESCRIPTION OF THE INVENTION

[0025] Referring initially to FIG. 1, a performance and flow analysissystem 20 operates in connection with a communication network 22. Thecommunication network 22 carries information between remote sites orcomputers. The information may consist of voice, video, files,electronic mail, etc. In the illustrated embodiment of the invention,the network 22 comprises a “packet” or “connectionless” communicationmodel. The system 20 is intended to manage enterprise networks. However,it is also suitable for management service provides (MSPs) that manage acustomer's networks.

[0026] The present invention relates particularly to “visualization”software operating in the network management system 20 for thevisualization of peformance and data flows on the communication network22. In the illustrated embodiment of the invention, the networkmanagement system 20 includes a dedicated management network 24 forgathering information from the communication network 22. A server 26 isconnected to the management network 24. The server 26 operates inaccordance with the visualization software, discussed above. A memory 28and display 30 are operatively connected to the server 26. The memory 28may consist of any type of memory, including ROM memory, RAM memory,fixed disk drives and removable disk drives, and the like. The memory 28stores the visualization software and the collected information in theform of a database, as described below. As is apparent, the memory 28may include plural discrete memory devices. Also, individual memorydevices can be considered as equivalent to separate memory devicesrelative to the specific data stored therein.

[0027] As will be apparent, the management network 24 may take any knownform and the server 26 may be an integral component of the managementnetwork 24. However, the server 26 is not intended to be a node in thecommunication network 22 as it hosts the visualization software formanagement purposes only.

[0028] The visualization software enables monitoring of informationflows in real time or deferred time. Visualization of traffic is enabledover a specific time span to quickly pinpoint and understand cause ofproblems which may arrive periodically, such as, for example,bottlenecks, application slowdowns, etc. As such, the visualizationsoftware provides complete visibility of the flows and the evolution ofthe flows. This is done using physical mapping of the network forvisualizing and understanding the complex exchange patterns betweenapplications and users.

[0029] Referring to FIG. 2, network devices A and B can be graphicallyrepresented as nodes 32. Network interfaces 34 associated with each node32 are interconnected via a link 36. Network devices 32 can generally beclassified as infrastructure devices, such as routers or switches, orthe like, which are used for forwarding packets. The network devices 32may also include terminal (LEAF) devices, such as servers, personalcomputers (PCs), work stations, printers, etc., that provide informationto or consume information from other devices. The links 36 are mainlycharacterized by their technology, such as Ethernet, ATM, etc., andtheir transmission speed which is usually represented in bits/second.The links 36 link network devices 32 through the network interfaces 34with one network interface 34 on each side of the link 36. In accordancewith the invention, the network management system 20 displays thenetwork elements shown in FIG. 2 in the form illustrated in FIG. 3.Particularly, the device nodes 32 are shown connected via a graph edge38. The edge 38, which also may be referred to as an “arc”, is the chartof a link 36 which interconnects two network node devices. Thus, a link36 is an object of the network, which is graphically displayed by anedge 38. The network interfaces 34 are hidden on the visual display.

[0030] Packet networks divide information into several smaller packets.These packets are then handled independently by network devices. TheInternet Protocol (IP) communication protocol is a typicalpacket-oriented protocol. The network 22 in FIG. 1 is made up of a largenumber of infrastructure devices, such as switches or routers, thatforward each packet in a required direction depending on a finaldelivery address. The success of a network is its ability to handlelarge amounts of information and to connect together virtually unlimitednumbers of users. Network performance management in accordance with theinvention is based on the periodical collection of local metrics or ontraffic simulation. The metrics are related to a specific device orinterface.

[0031] For effective network management, it is necessary to choose a setof metrics that will characterize the network's ability to transmit theflow of information that is submitted to it and qualify the type oftraffic (for example per protocol or per application, and per directionof traffic). Examples of the most frequently used metrics forperformance and flow analysis include;

[0032] input and output throughput of device interfaces, informationloss rate per device and per interface, overrunning of internal deviceresources (processors, memories, queues . . . ), etc,

[0033] Per Network protocol throughput (IP/IPX/. . . ), Per Applicationprotocol throughput (HTTP/SMTP/NNTP/SAP/Oracle . . . ), etc.

[0034] The analysis of performance and flows require the processing oflarge amounts of collected data samples. Several hundred samples up toseveral hundreds of thousands of samples only represent an instantaneoussnapshot of a network state, depending on the size of the network, andon its complexity. Furthermore, having a history of several sampleperiods is necessary to illustrate the dynamic nature of a network, andof its evolution. The present invention provides a specific andefficient presentation of the information in order to understand thecomplex system that the communication network represents.

[0035] The network management system 20, using samples of information,makes a snapshot of the network 22 and maps user-chosen metric values ona graphic representation of the physical network topology.Device-related metrics are mapped over the graph device nodes 32 whileinterface-related metrics are mapped over the graph edges 38. Inaccordance with the invention, the network management system 20 uses agraphic representation of topology of the network 22, techniques forrepresenting metrics over the graph element, referred to herein as“mappings”, automatic association methods between metrics and mappings,and an ergonomic and efficient presentation system, referred to hereinas “views”, that display only a subset of all available metrics.

[0036] Referring to FIG. 4, a classical graphical representation of thetopology of a network 100 is illustrated. The network 100 includes twoinfrastructure devices in the form of switches 102 and 104 connected toLEAF devices in the form of PCs 105-112. Node devices are represented bysymbols. Different symbols are drawn depending on the device type and onthe services the device provides. These services may include routingservices, switching services, VLAN (Virtual Local Area Network) service,etc. In order to be compared, the node devices occupy approximately thesame area on a visual display. Links are represented as connectionsbetween devices. An example is the line 114 between the PC 107 and theswitch 102. The links have speeds that can vary from several kilobitsper second to gigabits per second. The size of the link reflects thenominal speed of the link in the classical representation. Particularly,the thicker the line, the faster the link.

[0037] The present invention provides dynamic visual representation of anetwork. This is done to represent network load along with networkresources used. To do so, it is necessary to choose a few metrics out ofthe set of available metrics. These metrics may include, for example,the device load (number of packets per second handled by the device),the link throughput (bits per second) for each direction, and the linkload (for example, a percentile of its nominal throughput). FIG. 5illustrates mapping of the metrics in accordance with the invention fora network having a topology as shown in FIG. 4. As is apparent, the nodedevices 102 and 104 have different sizes when compared to therepresentation of FIG. 4, and the links are displayed as bidirectionalarrows. Particularly, the size of each infrastructure element depends onthe number of packets that go through the element. In the illustrationof FIG. 4, the switch 104 carries more packets than the switch 102resulting in the larger size. Bidirectional arrows have a differentthickness and a different contact point. The thickness and contactpoints depend on the throughput of each direction. In the illustrationof FIG. 5, it is apparent that there is a large flow of informationgoing from the PC 107 through the switch 102 and then to the PC 108.This traffic is far greater than the traffic involving the other PCs105, 106 and 109-112. The color of the link also depends on the linkutilization rate. In the illustration of FIG. 5 this is represented bythe darker color for the transfer from the PC 107 to the PC 108 as itrequires more link resources than all the other links in FIG. 5.

[0038] The mappings, i.e., techniques for representing metrics, are usedto graphically represent different types of information. The mappingsallow a user to visually and quickly evaluate a metric (for example, seeat a glance that a device load is near the device saturation) andcompare several metrics of the same type (for example all the throughputon a network). The following describes several mappings that could beused. As is apparent, not all possible mappings are described herein.

[0039] Symbol size variation can be used for mapping symbols for nodedevices as illustrated in FIG. 6. Particularly, the size of the symbolcan vary from a smaller size, as shown to the left of the arrow, and beincreased to a larger size, as shown to the right of the arrow. Thehigher the metric value, the larger the size of the node on the screen.Similarly, symbol color variation can be used by applying a colortransparency level on the symbol. The higher the metric value, thehigher the color level. A combination of this kind of mapping can beused with other mappings such as symbol size.

[0040] FIGS. 7-9 illustrate mapping symbols for links. Particularly,FIG. 7 illustrates link thickness variation. The higher the metricvalue, the thicker the link. FIG. 8 illustrates bidirectional thicknessvariation. This mapping simultaneously represents two metrics of thesame type. The higher the metric value, the larger the associated arrow.Also, the contact point of the arrows changes according to the relativemetric values in the two directions. FIG. 9 illustrates link layerthickness variation. This mapping represents simultaneously severalmetrics of the same type. The higher the metric value, the thicker theassociated layer. Line color variation or bidirectional color variationmay also be used with mapping symbols for links. This is done byapplying a color transparency on the link. The higher the metric value,the higher the color level on the link or on the associated arrow.

[0041] In the illustrated embodiment of the invention, several mappingsare general purpose mappings as they can be used very frequently andapplied to a large number of metrics. These include size variation,thickness variation and color variation which are well suited for thevisualization of the metrics such as load, volumes and rates, or thelike. For example, the CPU load of a device, a link throughput, theutilization rate of a device or of a link, or the collision rate of anEthernet link. Other mappings better fit other situations. For example,bidirectional arrows are well suited for oriented metrics. For example,flows going into or out of a device, errors detected on incomingpackets, or errors detected on outgoing packets. Color layers are wellsuited for distribution of homogeneous metrics. For example,visualization of traffic on a link, per communication protocol, perapplication or per VLAN, or distribution of the traffic on a link percomputer contributing to this traffic.

[0042] In order to provide a complete visualization technique, it isnecessary to handle special situations. These include:

[0043] Representation of an “in range” value: a value greater or equalto a minimum value and, lower or equal to a maximum value (These valuesmust be user definable). Representation of a value lower than theminimum value (out of range value). Representation of a value greaterthan the maximum value (out of range value). Representation of a missingvalue. This is a very frequent situation, often due to an unreachable orout of order device due to network or instrumentation problems.

[0044] For the first case (in range value) the “mapping” must representlinearly the metric value.

[0045] For the other cases, this can be qualified as “remarkable”, themapping must define for each situation a representation that allows todistinguish very easily this special value from an “in range” value.

[0046] The following table shows the various representations for eachsituation of the Mappings described above: Mapping Missing value Value<minimum [min >= value <= max] Value >maximum Symbol size Dashed cornersVery small symbol Symbol size “Exploded” Symbol linearly modified.Symbol color Transparent User defined color Color User defined colortransparency level applied linearly Link Standard thickness Thicknessset to 1 Thickness Maximum thickness + thickness Dashed line pixellinearly modified Dashed borders Link color Transparent User definedcolor Color User defined color transparency level applied linearlyBi-directional Standard thickness Thickness set to 1 Thickness Maximumthickness + arrow Dashed arrow pixel linearly modified Dashed bordersthickness

[0047] The symbols and edges used in the mapping technique are stored inthe memory 28. When metrics are selected to build a display theappropriate symbols or edges are selected from the memory in accordancewith the metrics to be analyzed, as will be apparent.

[0048] For association methods between metrics and mappings, metrics canbe collected in various manners. Among these are real time counterspolling from the devices, information pushed from devices or to thesystem, or a query from a database, the database being fed by acollection process. Metrics are always associated with instrumentedobjects. An instrumented object is an object able to providemeasurements. Network devices and network device interfaces are objectswhich can be instrumented. Often, a link is not an object which can beinstrumented. Therefore, a metric is often not directly associated witha link. FIG. 2, discussed above, shows the real elements involved in aconnection between devices. The presentation system representation isshown in FIG. 3. In order to facilitate presentation of metrics on anedge, the presentation technique herein defines rules that willassociate these metrics with an edge:

[0049] that are directly related to the edge when direct edge metricsare available, or

[0050] that are not directly related to the edge when direct edgemetrics are not available, and relevant metrics are available elsewhere.

[0051] The visualization software includes a metric/mapping associationsystem. This system is in charge of finding all relevant metrics foreach type of presented objects (nodes/edge) from the set of allavailable metrics. The system also applies rules to select the bestmetric when several choices are available. In certain cases, mostnotably edges, the system hides the metric choice complexity, thusmaking it seem to the user that all metrics are directly “collected”from the presented object.

[0052]FIG. 10 illustrates an example where metrics are gathered fromends of the edge. The available metrics are the input and outputthroughput for each device 32. This information comes from the deviceinterfaces 34. In the illustration, they are named “A.in”, “A.out”,“B.in” and “B.out”. Normally, A.in provides the same values of B.out,and A.out provides the same values as B.in. Representing the throughputgoing from A and B (named “A.O” and “B.O”) can be done in four ways: A.O= A.out, B.O = B.out (metrics issued from two ends) A.O = A.out, B.O =A.in (metrics issued from only one end: A) A.O = B.in, B.O = B.out(metrics issued from only one end: B) A.O = B.in, B.O = A.in (metricsissued from the two ends, but inverted)

[0053] An example is illustrated in FIG. 11.

[0054] In certain cases, metrics are only available at one end of anedge. This reduces the number of possible choices. Among others,possible cases include only one device being instrumented. In this case,the only choice is [A.O-A.out, B.O=A.in], or [A.O=B.in, B.O=B.out]depending on the instrumented device. Another possible case is thatthere is a missing metric on one side. For example, B.out is missing. Inthis case, the number of choices is reduced to two, i. e., [A.O=A.out,B.O=A.in] or [A.O=B.in, B.O=A.in].

[0055] The following illustrates an example of representing a number ofEthernet collisions on an edge between two devices. This example relatesto a situation where the metric available on a device interface isrelated to the link, although it is provided by the interface. Thecollision number is a metric that is usually provided by a deviceinterface, but it represents the number of collisions detected on themedia, not on the interface itself. Although this metric is provided bya device interface, it is in fact related to the edge on the graphicrepresentation of the network. The metric/mapping association system hasto associate this interface metric with the edge, or will have tochoose, randomly or arbitrarily, one metric in case this metric isavailable on the two ends.

[0056] Every network element, such as a node or an edge, can providedozens of metrics. Physiologically, a person is unable to perceive sucha great amount of information at the same time, for each node.and edgerepresenting a network. Assuming a person is able to perceive two tothree different metrics per element type, there are a maximum of sixdifferent metrics for a network representation made of two types ofelements, namely nodes and edges. The visualization software describedherein applies a “view” principle to the presentation and mappingtechniques described. A view is a subset of metrics per element type.This subset is applied to the graph that represents the network and is asubset for nodes, typically up to two, and a subset for edges, typicallyup to three. Each metric is applied to all the elements of the sametype. For example, if the CPU utilization metric is chosen for nodes,then all the nodes will display their CPU utilization metric. The viewprinciple allows the user to focus on one or several aspects of thenetwork. For example, flow analysis, congestion analysis or stateanalysis. Flow analysis considers the kind of traffic, the communicationprotocols used, the applications used and the volumes being transferred.Congestion analysis considers the bottlenecks, the resource usage andcollisions. The state analysis considers which devices or links aredown, the availability of the devices, and the most frequently faultydevices. Alternative types of use might also be used.

[0057]FIG. 12 illustrates a network to be analyzed for a flow/volumeview usage case. This view is based on three metrics. Device workload ismapped on device size. The higher number of packets across a device, thelarger the device. Input and output throughput are mapped on edges,represented by bidirectional arrows. The higher the volume in onedirection, the thicker the arrow. The total throughput on edges isrepresented by a color variation. The greater the traffic, the morecolor in the edge. FIG. 12 illustrates the topology for a network 120 tobe analyzed for the flow/volume usage case. FIG. 13 illustrates avisualization display generated using the system 20 of FIG. 1 for thenetwork 120 of FIG. 12 under certain conditions. Particularly, this viewof FIG. 13 shows the current flows between devices and particularlypinpoints the greatest flow which is going from a device 122 to a device124. This flow is through several other devices.

[0058] For a flow/congestion view usage case, the view is based on adifferent set of metrics. Device workload is mapped on device size. Thehigher number of packets across a device, the larger the device. Inputand output throughput are mapped on edges, represented by bidirectionalarrows. The higher the volume in one direction, the thicker the arrow.The link's usage rate is mapped on edges and represented by a colorvariation. The more congested the link, the more color in the edge.

[0059]FIG. 14 illustrates an example of a flow/congestion view usagecase for the network 120. This view gives the user a new vision of thephenomenon. In fact, the link between the central device 126 and thedevice 124 has a higher transfer rate than the others. This means thatalthough the transfer is great, the link is not overloaded. But theother links are near saturation. One can imagine that the transfer rateis limited by the links between the device 122 and the central device126.

[0060] Other views such as views expressing the correlation betweencollision rate and response time or collision rate and volume, wouldprovide valuable information for understanding the behavior of thenetwork and analyzing it.

[0061] Referring to FIG. 15, a database 40 is represented graphically.The database 40 is stored in the memory 28 of FIG. 1, as describedabove. Among the information stored in the database 40 are topologyrepresentations 42 and metric samples in the form of statistics 44.These statistics are illustrated in three-dimensional form as “Ine”(representing instrumented network elements), metrics and time. Asnapshot of these statistics represents a plane cut through thethree-dimensional representation at a given time to illustrate themetrics at that time for all of the Ine's.

[0062] Referring to FIG. 16, a flow diagram illustrates a programimplemented in the server 26 of FIG. 1 for building the database 40. Theprogram begins at a block 46 where a network is defined. A network isdefined by identifying the node devices 32 and edges 38 that make up thenetwork to provide the network topology 42, see FIG. 15. The topology 42is stored at a block 48. As is apparent, the database 40 may storenumerous different network topologies. Thereafter, a decision block 50determines if it is necessary to update the database statistics 48. Theupdate is initiated at the appropriate time based on the techniquesbeing used for collecting metrics, as discussed above. The programcontinues to loop about the block 50 until it is necessary to update thedatabase. When an update is to occur, then the Ine's are polled at ablock 52, in one embodiment. The collected metrics are then stored at ablock 54 and the program returns to the decision block 50. The flowdiagram of FIG. 16 will vary according to the particular collectionprocess being used, as will be apparent to those skilled in the art.

[0063] Referring to FIG. 17, a flow diagram illustrates operation of thevisualization program for performance and flow analysis for acommunication network. The program begins at a block 60 where the userselects a topology to be analyzed and a part of the topology, ifnecessary. The server 26 accesses the topology from the database 40, seeFIG. 15. At a block 62 the user selects a view. The system 20 uses theview system in order to build a list of all metrics that could fulfillrequirements. Depending on a previous list, and a set of elements thatare instrumented, the system applies the rules defined in themetric/mapping association system, described above, to select the bestavailable metrics. These are the metrics defined by the view oralternative metrics when the ideal metric is not available. At a block64 the user selects the time for analysis. The time may be a specifictime or date or may be an interval of time for analysis. The system 20queries the statistics database 44 at a block 66 to retrieve the metricsamples at the selected time. At a block 68 the system 20 sets scales tobe used. For each type of metric the minimum and maximum values aresearched to set the scales. For each type of metric the highest value ofthe scale is set to the maximum sample value found over the specifiedinterval and the lowest value of the scale is set to the minimum samplevalue found.

[0064] Thereafter, a display is built at a block 70. The display isbuilt using the selected topology and the mapping techniques forrepresenting metrics, discussed above. This is done by using the correctmapping and applying the rules for the particular mapping. The displayis then viewed at a block 72 on the display 30, see FIG. 1.

[0065] An example of the operation of the flow diagram of FIG. 17 is nowdescribed with respect to FIGS. 18 and 19. FIG. 18 shows a topologyrepresentation which could be selected at the block 60. In this topologythere are four network devices 74, 75, 76 and 77. These devices areconnected by various links, as shown. At the block 62, the user selectsa view that will display traffic per VLAN. VLANs are logical networksthat share a same physical network. VLANs are identified by numbers inthe range [1 . . . 1024]. A VLAN number is comparable to a link metric.This view specifies the ideal metrics that are required and thealternative metrics that could provide the same information. For eachdevice 74-77 the workload metric (the number of packets across thedevice) is the ideal metric. There is no alternate metric. On each link,the input and output throughput metrics are the ideal metrics.Alternative metrics are described above relative to association methodsbetween metrics and mappings. For each link the VLAN number metric is anideal metric. This metric should be available from any one of the twoends of the link. An alternative metric is the VLAN number metric fromthe opposite end of the link. The system 20 compares the ideal metriclist with what is available from the selected elements that make theselected type topology. Alternate metric choice methods are applied whenideal metrics are not available. The system builds the list of availablemetrics for each network element.

[0066] After the user selects the time or interval for analysis, theminimum and maximum values are searched over the specified interval inorder to set the scales at the block 68. On this topology, four devices74-77 provide the workload metric. The query gets the following samples(one per each five minutes between 2 a.m. and 2:30 a.m.):Device/Date/Value 2:00 AM 2:05 AM 2:10 AM 2:15 AM 2:20 AM 2:25 AM Device74 50 pp/s 200 pp/s 30 pp/s 210 pp/s  25 pp/s 35 pp/s Device 75 20 pp/s 40 pp/s 28 pp/s 30 pp/s 40 pp/s 40 pp/s Device 76 45 pp/s 100 pp/s 110pp/s  40 pp/s 80 pp/s 35 pp/s Device 77 50 pp/s  60 pp/s 40 pp/s 35 pp/s25 pp/s 10 pp/s

[0067] The lowest value of the scale for the workload type of metric isset to 10 pp/s per second, as determined by device 77 at 2:25 a.m. Thehighest value of the scale is set to 210 pp/s per second, as determinedby the device 74 at 2:15 a.m. The same processes are run for the inputand output throughput and VLAN number metrics.

[0068] Thereafter, the view system is used to get from the view how torepresent the metrics. This view specifies to represent the workloadmetric as a node size variation, the input and output throughput metricas bidirectional arrows with variable thickness, and the VLAN numbermetric as link color, one color per VLAN number. The mapping rules areapplied to represent sample values according to the specified mappingsas illustrated in FIG. 19. Particularly, FIG. 19 illustrates the resultsat 2:15 a.m. The Device 74 has the highest workload (210 pp/s) and theother devices 75, 76, 77 have a similar and rather low relative workload(30, 40 and 35 pp/s). One can visually see in FIG. 19 that Device 74 isthe most used device on this network and that the other devices have asimilar load relative to one another. The links are colored according totheir VLAN number. Each distinct VLAN is assigned a different color. Inthe illustrated embodiment of the invention, five different VLANs crossthe Device 74 and are helpful in analyzing the traffic distribution perVLAN. Bidirectional arrow thickness represents the input and outputthroughput for each link. The thicker the arrow, the greater the trafficin that direction.

[0069] The present invention has been described with respect toflowcharts and block diagrams. It will be understood that each block ofthe flowchart and block diagrams can be implemented by computer programinstructions. These program instructions may be provided to a processorto produce a machine, such that the instructions which execute on theprocessor create means for implementing the functions specified in theblocks. The computer program instructions may be executed by a processorto cause a series of operational steps to be performed by the processorto produce a computer implemented process such that the instructionswhich execute on the processor provide steps for implementing thefunctions specified in the blocks. Accordingly, the illustrationssupport combinations of means for performing a specified function andcombinations of steps for performing the specified functions. It willalso be understood that each block and combination of blocks can beimplemented by special purpose hardware-based systems which perform thespecified functions or steps, or combinations of special purposehardware and computer instructions.

[0070] Thus, in accordance with the invention there is provided a newand effective way of analyzing collected performance and flowinformation for large networks, allowing a user to understand what'shappening on a network.

I claim:
 1. A system for visually representing performance and flowanalysis of a communication network having devices connected by links,comprising: a first memory for storing a graphical representation of thecommunication network and showing the devices connected by links; asecond memory storing data representing performance and flows in thecommunication network; a display; and a processing system operativelyconnected to the first and the second memory and to the display, theprocessing system selectively mapping the data on the graphicalrepresentation of the communication network by varying visualcharacteristics of the devices and the links for viewing on the display.2. The system of claim 1 wherein the second memory comprises a databaseof metric values for the devices and the links taken at select times. 3.The system of claim 2 further comprising a data collection system forcollecting data from the devices and the links at the select times tobuild the database.
 4. The system of claim 1 wherein the processingsystem selectively maps the data on the graphical representation of thecommunication network by varying size of the devices and the links forviewing on the display responsive to variation in performance and flowsin the communication network.
 5. The system of claim 1 wherein theprocessing system selectively maps the data on the graphicalrepresentation of the communication network by varying color of thedevices and the links for viewing on the display responsive to variationin performance and flows in the communication network.
 6. The system ofclaim 1 wherein the data comprises metrics of a plurality of performanceand flow characteristics and the processing system maps select ones ofthe metrics responsive to selection of a desired view of thecommunication network.
 7. A method for visually representing performanceand flow analysis of a communication network having devices connected bylinks, comprising: storing in a memory a graphical representation of thecommunication network and showing the devices connected by links;storing in a memory data representing performance and flows in thecommunication network; selectively mapping the data on the graphicalrepresentation of the communication network by varying visualcharacteristics of the devices and the links to build a graphicaldisplay; and displaying the graphical display on a video display device.8. The method of claim 7 further collecting data from the devices andthe links at select times to build a database.
 9. The method of claim 7wherein selectively mapping the data comprises mapping the data on thegraphical representation of the communication network by varying size ofthe devices and the links for viewing on the display device responsiveto variation in performance and flows in the communication network. 10.The system of claim 7 wherein selectively mapping the data comprisesmapping the data on the graphical representation of the communicationnetwork by varying color of the devices and the links for viewing on thedisplay device responsive to variation in performance and flows in thecommunication network.
 11. The method of claim 7 wherein the datacomprises metrics of a plurality of performance and flow characteristicsin the communication network.
 12. The method of claim 11 furthercomprising selecting a desired view of the performance and flows in thecommunication network, the desired view being represented by select onesof the metrics.
 13. The method of claim 11 wherein selectively mappingthe data on the graphical representation of the communication networkcomprises setting a scale of the metrics using minimum and maximumvalues of the metrics, the scales being used to vary visualcharacteristics of the devices and the links.
 14. A method for mappingperformance and flow analysis of a communication network having devicesconnected by links for display on a display device, comprising: storingin a memory a graphical representation of the communication network andshowing the devices connected by links; storing in a memory datarepresenting performance and flows in the communication network; storinga plurality of symbols representing different devices and a plurality ofedges representing links; selectively mapping the data on the graphicalrepresentation of the communication network by varying visualcharacteristics of the symbols and the edges responsive to theperformance and flows in the communication network to build a graphicaldisplay; and displaying the graphical display on a video display device.15. The method of claim 14 wherein selectively mapping the datacomprises mapping the data on the graphical representation of thecommunication network by varying size of the symbols and the edges forviewing on the display device responsive to variation in performance andflows in the communication network.
 16. The system of claim 14 whereinselectively mapping the data comprises mapping the data on the graphicalrepresentation of the communication network by varying color of thesymbols and the edges for viewing on the display device responsive tovariation in performance and flows in the communication network.
 17. Thesystem of claim 14 wherein the edges comprise bidirectional arrows fororiented metrics and varying visual characteristics of the bidirectionalarrows comprises varying thickness of the arrows and contact point ofthe arrows.
 18. The system of claim 14 wherein the edges compriselayered lines with each layer representing a different metric.
 19. Asystem for mapping performance and flow analysis of a communicationnetwork having devices connected by links, comprising: a first memoryfor storing a graphical representation of the communication network andshowing the devices connected by links; a second memory storing datarepresenting performance and flows in the communication network; a thirdmemory storing a plurality of symbols representing different devices anda plurality of edges representing links; processing means forselectively mapping the data on the graphical representation of thecommunication network by varying visual characteristics of the symbolsand the edges responsive to the performance and flows in thecommunication network to build a graphical display.
 20. The system ofclaim 19 wherein the processing means maps the data on the graphicalrepresentation of the communication network by varying size of thesymbols and the edges responsive to variation in performance and flowsin the communication network.
 21. The system of claim 19 wherein theprocessing means maps the data on the graphical representation of thecommunication network by varying color of the symbols and the edgesresponsive to variation in performance and flows in the communicationnetwork.
 22. The system of claim 19 wherein the edges comprisebidirectional arrows for oriented metrics and the processing meansvarying visual characteristics of the bidirectional arrows comprisesvarying thickness of the arrows and contact point of the arrows.
 23. Thesystem of claim 19 wherein the edges comprise layered lines with eachlayer representing a different metric and the processing means maps thedata on the graphical representation of the communication network byvarying visual characteristics of each layer independently responsive tovariation in performance and flows in the communication network.